Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementMedium
During a critical incident, a SOC manager needs to generate a comprehensive report that includes key metrics such as mean time to detect (MTTD), mean time to respond (MTTR), and the number of active incidents by severity. This report must be presented to executive leadership weekly. Which Cortex XSOAR feature is best suited for creating and regularly delivering such a report?
- AWar Room entries
- BDashboards and widgets
- CIncident playbooks
- DCustom incident fields
Show answer & explanationAnswer & explanation
Correct answer: B. Dashboards and widgets
Dashboards and widgets in Cortex XSOAR are specifically designed for visualizing incident metrics, creating custom reports, and can often be scheduled for regular delivery, making them ideal for executive reporting.
Why the other options are wrong
- A. War Room entries are for real-time collaboration logs, not aggregated reporting.
- C. Incident playbooks automate response actions, not generate executive reports.
- D. Custom incident fields store data, but don't generate reports themselves.
Cortex XSOAR Dashboards
Cortex XSOAR dashboards provide customizable visual representations of incident data and operational metrics, allowing users to monitor trends, track performance, and generate reports.
- Composed of various widgets (charts, lists, indicators).
- Can be filtered and saved for different audiences.
- Supports scheduled reporting and data export.
Memory trick: Dashboard displays, no need for guessing games.